Privacy Policy

---

 Carpenter Collective, LLC ("we," "our," or "us") values your privacy. 

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website https://carpentercollective.org, communicate with us via phone, text, email, or visit us in person.

We may collect the following types of information:

Personal Information:

• Full name
   
• Email address
   
• Phone number
   
• Mailing address
   
• Social Security number (for tax services)
   
• Date of birth
   
• Health and income information (for insurance and financial services)
   

Non-Personal Information:

• Browser type
   
• Device information
   
• IP address
   
• Website usage data (via cookies or tracking tools)
   

We may use your information to:

• Provide insurance, tax, and financial services
   
• Process applications and payments
   
• Respond to inquiries and customer support requests
   
• Send important service-related updates
   
• Conduct marketing (with your consent where required)
   
• Comply with legal or regulatory obligations
   

We do not sell your personal information. We may share it with:

• Licensed insurance carriers, tax agencies, and financial institutions to provide requested services

• Carpenter Collective LLC may collaborate with independent licensed agents, brokers, and partner organizations during outreach or enrollment events. These partners act as authorized representatives under Carpenter Collective’s compliance framework and are required to follow the same data privacy, HIPAA, and confidentiality standards.

• All client data collected through Carpenter Collective-branded forms, digital platforms, or event systems is securely transmitted and retained by Carpenter Collective LLC in accordance with HIPAA and applicable state privacy laws.

• Third-party service providers (e.g., CRM systems, secure email, text platforms) under confidentiality agreements
   
• Government agencies, when legally required
   

We implement reasonable physical, technical, and administrative safeguards to protect your personal information from unauthorized access, use, or disclosure.

You can:

• Opt-out of marketing emails or texts at any time
   
• Request access to, correction of, or deletion of your personal information (subject to legal limitations)
   
• Manage cookie preferences through your browser settings
   

Our services are not directed at children under 13. We do not knowingly collect information from minors without verifiable parental consent.

Our website may contain links to third-party sites. We are not responsible for their privacy practices. Please review their privacy policies.

We may update this policy from time to time. We will notify you of significant changes by posting the new policy on our website with an updated effective date.

If you have questions or concerns about this Privacy Policy, contact us at:

Carpenter Collective, LLC
Email: info@carpentercollective.org

Effective Date: Same as main Privacy Policy
Last Reviewed: October 2025

Carpenter Collective, LLC values your trust and takes the protection of your personal and health information seriously. This addendum supplements our existing Privacy Policy to address protections for Personally Identifiable Information (PII) and Protected Health Information (PHI) collected during our insurance, healthcare, and financial-planning services.

For purposes of compliance with the Health Insurance Portability and Accountability Act (HIPAA), “Protected Health Information” means individually identifiable health information transmitted or maintained by Carpenter Collective LLC in any form or medium (electronic, paper, or oral), including but not limited to:

• Health-status details, diagnoses, medications, or treatment information shared during enrollment or consultation
   
• Medical history, provider details, or policy-related claim information
   
• Health plan membership, ID numbers, or subsidy/assistance eligibility data
   

Carpenter Collective LLC functions as an insurance agency and educational consultant and, and may act as a Business Associate to certain covered entities under HIPAA.

We use and disclose your personal and health information only as permitted by law, including:

• To process enrollment in Medicare, Medicaid, Marketplace, or employer-based insurance plans
   
• To verify identity, eligibility, and payment information with carriers or government agencies
   
• To communicate with healthcare providers, plan administrators, or authorized representatives as directed by you
   
• For internal operations such as auditing, training, compliance, or customer-service improvement
   
• When required by law, regulation, subpoena, or government request
   

We do not sell, rent, or trade any PII or PHI for marketing purposes.

When using, disclosing, or requesting PHI, Carpenter Collective LLC limits such information to the minimum necessary to accomplish the intended purpose.

We retain records only for as long as required by:

• Applicable federal or state insurance and financial-recordkeeping laws (typically 7 to 10 years)
   
• Carrier audit and regulatory requirements
   

After retention periods expire, physical and electronic records containing PII or PHI are securely destroyed or de-identified.

We employ physical, administrative, and technical safeguards consistent with 45 CFR 164.308–164.312, including:

• Encrypted data storage and transmission
   
• Access controls with role-based permissions
   
• Multi-factor authentication for systems containing client data
   
• Confidentiality agreements for employees and contractors
   
• Regular risk assessments and security training
   

If we discover an unauthorized acquisition, access, or disclosure of unsecured PHI or sensitive PII, Carpenter Collective LLC will:

• Investigate the incident promptly
   
• Mitigate any potential harm
   
• Notify affected individuals without unreasonable delay and no later than 60 days from discovery, consistent with 45 CFR 164.404–164.410
   
• Report to HHS and other authorities as required by law
   

You have the right to:

• Request access to or a copy of your information
   
• Request correction or amendment of inaccurate data
   
• Request restrictions on certain uses or disclosures (where feasible)
   
• Request an accounting of disclosures of your PHI
   
• Withdraw consent for marketing communications
   

Requests may be submitted to info@carpentercollective.org.

By using our website, completing enrollment forms, or providing information to our agents, you acknowledge and consent to the terms of this Privacy Policy and any related HIPAA Authorizations you sign. Certain uses and disclosures—such as marketing or sharing information with third-party partners—will require specific written authorization.

Carpenter Collective LLC may engage third-party service providers who require access to limited PII/PHI (e.g., quoting software, secure-email, e-signature, or data-storage vendors).
Each partner is required by contract to implement comparable safeguards and comply with HIPAA or equivalent data-protection standards.

We may revise this Addendum periodically to reflect regulatory updates or new security practices. Any updates will be posted at https://carpentercollective.org/privacy-policy with a revised “Last Updated” date.